OneKey Founder: Chip-Level Vulnerabilities Exist in iPhone 11 and Earlier Models; Airplane Mode Cannot Guarantee Seed Phrase Security

OneKey founder Yishi warned on X on November 1 that repurposing factory-reset older iPhones as offline crypto cold wallets carries underappreciated security risks, as iPhone 11 and earlier models contain chip-level BootROM vulnerabilities that cannot be patched via iOS updates. The checkm8 exploit affects iPhone 4S through iPhone X, while the usbliter8 vulnerability, disclosed in June, extends to the iPhone XS, XR, 11 series, and second-generation iPhone SE. Attackers with physical access can exploit DFU mode and custom USB hardware to execute code before iOS boots, meaning airplane mode offers no protection. However, the BootROM flaw alone does not directly expose seed phrases, as device passcodes, the Secure Enclave, and wallet app encryption provide additional layers of defense. Yishi advised users storing seed phrases on old iPhones to migrate to newer devices, generate entirely new seed phrases in a trusted environment, and move assets to the new wallet rather than merely changing addresses under the old phrase. Users of legacy iPhones as cold storage should watch for further exploit disclosures and updated guidance from hardware wallet makers.